Binance Net Inflows Turn Positive at $2.3 Billion as Withdrawals Expand

Binance recorded approximately $2.3 billion in net inflows over a 24-hour period as the cryptocurrency exchange continued restoring withdrawal services following last week's $6.3 billion security breach.

According to data from DefiLlama, Binance led all tracked centralized cryptocurrency exchanges in daily net inflows, indicating a reversal in fund movements after several days of substantial withdrawals.

Other major exchanges also reported positive flows during the same period, with Bitfinex attracting approximately $280 million and Bitget recording around $127 million.

Binance sees $2.3 Billion in net inflows following major hack

The latest figures represent a significant change, when Binance experienced more than $7 billion in net outflows within 24 hours. At that time, OKX led centralized exchanges in positive fund movements, recording approximately $445 million in net inflows.

The next day, however, Binance had returned to the top of DefiLlama's exchange inflow rankings, suggesting that deposit activity was recovering as withdrawal services became more widely available. The exchange acknowledged the improvement in a post on X.

“By 03:00 UTC, we are seeing hourly deposits exceed withdrawals, reflecting improving user activity and stabilizing flows,” Binance said. The recovery in net inflows follows a period of heightened uncertainty after the exchange suffered a record-breaking cryptocurrency theft involving approximately $6.3 billion in digital assets.

While the latest figures indicate that more assets were entering Binance than leaving during the measured period, they do not necessarily establish that user confidence has fully recovered. Nevertheless, the reversal suggests that transaction activity has begun stabilizing following the initial wave of withdrawals.

Binance gradually restores withdrawals and replaces affected assets

Binance suspended withdrawals after the $6.3 billion attack occurred the previous day, allowing the exchange to investigate the incident and conduct additional security checks. The company began restoring withdrawal functionality in stages.

Binance expanded the recovery process by reopening withdrawals for certain fiat currencies, while exchange outflows showed signs of slowing. The phased approach was intended to restore customer access to funds while maintaining security measures following the breach.

In a recovery update, Binance reported that it had already replaced approximately 95% of the affected assets. The remaining 5% consisted primarily of less liquid cryptocurrencies, which required additional time to obtain through market purchases and over-the-counter transactions.

Binance has maintained that customers will not be responsible for losses resulting from the attack. Instead, the exchange has committed to covering the stolen assets through its own financial resources and user protection funds. The replacement of affected assets and gradual reopening of withdrawal services have been central components of Binance's recovery efforts.

FBI attributes Binance hack to North Korea as government denies involvement

The investigation into the record cryptocurrency theft has also attracted attention from US law enforcement authorities. The Federal Bureau of Investigation (FBI) attributed the $6.3 billion attack to North Korea.

The allegation follows previous investigations linking North Korean cybercriminal groups to major cryptocurrency thefts, although the latest attribution has been disputed by the North Korean government. North Korea rejected responsibility for the Binance breach.

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, dismissed the accusations as “absurd rhetoric.” The conflicting statements highlight the continuing dispute over responsibility for the attack as Binance works to restore normal operations.

The incident remains the largest reported cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack in February 2025. Despite the scale of the breach, Binance's latest inflow figures suggest that trading and deposit activity is recovering as the platform restores services and continues replacing affected assets.

The exchange's ability to maintain stable operations, complete its asset recovery process and address outstanding security concerns will remain important factors in assessing its longer-term recovery.

Sources:

https://www.binance.com/en-GB/support/announcement/security-incident-recovery-update-4-withdrawals-resume-in-phases-2026-11-01-73911fb819b240f88b88256bdd318eda

https://x.com/binance/status/2117164969582330063?a=UKzBKlKjnc6ogKmDti8&s=20

https://cointelegraph.com/news/binances-daily-inflows-positive-18b-withdrawals

https://defillama.com/cexs